In order for PDF and 3D Objects to be viewable in sul_embed JavaScript needs to fetch the file (PDF or GLB) from Stacks. This works fine in cases where the file is public. But if the file is Stanford Only the fetch request needs to include credentials (assuming they are logged in) or else the request will be denied.

Unfortunately, it's not possible to send credentials unless Stacks sends Access-Control-Allow-Origin: embed.stanford.edu in its response instead of Access-Control-Allow-Origin: embed.stanford.edu: *. From the MDN docs:

Note: Access-Control-Allow-Origin is prohibited from using a wildcard for requests with credentials: 'include'. In such cases, the exact origin must be provided; even if you are using a CORS unblocker extension, the requests will still fail.

It's also important that Stacks send this header ONLY when responding to requests for Stanford Only items. Otherwise JavaScript applications running outside of embed.stanford.edu will no longer be able to access public files.

It looks to me like the proposed work in #1063 would send the correct CORS header when a Stanford Only file is being sent? This was only for the auth controller, and now for viewing files. But I believe similar logic would be needed to only send the host specific CORS header when an attempt is being made to view a Stanford Only item?

See also: sul-dlss/sul-embed#1642